The EU General Data Protection Regulation (GDPR) came into force across the European Union on 25th May 2018 and brought with it the most significant changes to data protection law in two decades. Based on privacy by design and taking a risk-based approach, the GDPR has been designed to meet the requirements of the digital age.
The 21st Century brings with it broader use of technology, new definitions of what constitutes personal data, and a vast increase in cross-border processing. The new Regulation aims to standardise data protection laws and processing across the EU, affording individuals stronger, more consistent rights to access and control their personal information.
Bright Classroom Ideas is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place, which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the GDPR. Our objectives for GDPR compliance have been summarised in this statement:
We have carried out an information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed and if and to whom it is disclosed.
Who is collecting the data?
We use a third-party provider, MailChimp, to deliver our newsletter. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. For more information, please see MailChimp’s privacy notice.
What data is being collected?
We are only collecting the bare minimum of personal data required to achieve our stated objective (see below). That is email addresses only. We do not collect names or other sensitive information or high-risk data whatsoever.
How do we ensure data accuracy?
We take all reasonable steps to ensure that we address data inaccuracies without delay: incorrect data is rectified or deleted. In practice, if someone contacts us to update their email address, we take action on it without undue delay.
But being proactive is also important. We check our mailing list regularly and remove bounced addresses.
How is data being securely stored?
We do not store psysically any kind of data. Everything is stored by our newsletter provider, MailChimp, which is one of the top organizations worldwide in this field. What is more, we are not accessing the website from portable devices like smartphones or tablets, and we never share system login details with others. Finally, we are using Wordfence, a highly reputable security plugin, to protect our website from hacks and malware.
What is the legal basis for processing the data?
The legal basis for processing personal data is consent — that is, where the individual has specifically agreed via the checkable box that we may use their data in a specific way, as mentioned below. We are very clear in what consent means, without using any vague terms or generalized statements. To this purpose, we use double opt-in in our campaign management tools, to make sure that there is no room for misunderstanding.
Will the data be shared with any third parties?
Some cookies are essential to the operation of the site, while others give us insights into how the site is used and allow us to personalise our services. Only essential and non-personal cookies are set when you first visit the site, but by continuing to use the site, we will set some non-essential cookies. You can opt-out at any point.
Wherever possible (e.g. with Google Analytics) we use non-privacy intrusive cookies, which means that traffic is anonymized and particular individuals cannot be identified.
How will the information be used?
Data is only used for specified, legitimate purposes. We use the emails we collect a) to send free products to our subscribers (e.g. eBooks), and b) to send out our free eNewsletter.
How long will the data be stored for?
All data will be held until permission is revoked by their owners. On top of that, we do our own data house-cleaning every five years, to make sure all email addresses that we have are accurate and active. If not, they are deleted permanently.
What rights does the data subject have?
All email campaigns that we run include an unsubscribe link. You can unsubscribe to general mailings at any time of the day or night by clicking the unsubscribe link at the bottom of any of our emails or by emailing us directly at firstname.lastname@example.org. In both cases, we will permanently delete your email address from our database. You can also use the same address to contact us in order to correct or complete your data, or if you have specific questions.
How can the data subject raise a complaint?
You can raise a complaint at email@example.com. We will respond within 48 hours.